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DETAILED ACTION 



Response to Amendment 



An objection to the title is withdrawn since it is being amended accordingly. 
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Claims 1,6,7,9,13,14,16,20,21,23,28 and 29 are amended. 
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Claims 1-30 are rejected by the same ground of rejections. 



Claim Rejections - 35 USC §103 



4. The following is a quotation of 35 U.S.C 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 



5. Claims 1-5, 9-12,16-19 and 24-26 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Hegde (U.S. 6,570,875) in view of McKee (U.S. 5,539,659). 

Regarding claims 1, 9 and 16, Hegde , 875 discloses a network node (see FIG. 2, 
Multiprotocol Switch 40) for collecting network traffic data having one or more processing 
engines (see FIG. 2, CPU 80) and a memory (see FIG. 2, Shared Memory 90) comprising a 
set of instructions to: 

receive a group of information (see FIG. 2, Input/output ports 50 receive IP packet; 
see col. 4, lines 34-53, see FIG. 7, S30 and S32; see col. 8, lines 250 to col. 9, lines 390); 

determine whether to process the group of information for network traffic data 
collection (see FIG. 8, S42, S44; see col. 2, lines 65 to col. 3, lines 9; see col. 9, lines 40-55; 
note that EP header is extracted and determined if the flow (i.e. source and destination) is in 
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the flow table for updating/creating the new forwarding information in the flow table 70 (also 
see FIG. 5)); 

process the group of information for network traffic data collection if the 
determination is to process the group of information (see FIG. 9, S72, S94; see col. 3, lines 3- 
5,see col. 10, lines 36-44, see col. 11, lines 65 to col. 12, lines 5; note that the new 
forwarding information is created in the flow table when the flow from extracted IP header is 
not in the flow table; also see FIG. 10 for recording/collecting the entries in the flow table); 
and 

forward the group of information to the destination (see FIG. 8, S46, S50; see col. 3, 
line 4-10, see col. 10, lines 24-32; note that once the flow is identified and the address is 
resolved, the IP packet is forwarded according to the designated flow); 

Hegde'875 does not explicitly disclose collection according to a sample algorithm. 

However, the above-mentioned claimed limitations are taught by McKee'659. In 
particular, McKee'659 teaches network traffic data collection according to a sample 
algorithm (see FIG. 6, a method/algorithm which collects network traffic data (i.e. a 
monitoring system which randomly collects the traffic data from the sample packets, thus, it 
is a sample method); see col. 1, lines 13-24, see col. 2, lines 67 to col. 3, lines 16). 

In view of this, having the system of Hegde'875 and then given the teaching of 
McKee'659, it would have been obvious to one having ordinary skill in the art at the time the 
invention was made to modify the system of Hegde'875, for the purpose of providing a 
network traffic data monitoring and collection method on sample packets, as taught by 
McKee'659, since McKee'659 states the advantages/benefits at col. 3, lines 5-39 that it would 
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facilitate the identification of significant data items relevant to management of a network. 
The motivation being that by monitoring and collection data, it can increase the network 
performance since the system is able to collect data regarding the network and path 
configuration, provisioning, routing, forwarding for future use, and to identify any potential 
problems in the network. 

Regarding claims 2, 10, 17 and 24, Hegde'875 discloses wherein the group of 
information is an IP packet (see FIG. 2, IP packet; see col. 4, lines 34-53, see FIG. 7, S32; IP 
packet see col. 8, lines 250 to col. 9, lines 390). 

Regarding claims 3, 11, 18 and 25, McKee'659 discloses wherein the sample 
algorithm is selected from one of linear, exponential, natural log, burst, and traffic attribute 
(see FIG. 6, a method/algorithm which collects network traffic attributes/data (i.e. a 
monitoring system which randomly collects the traffic data from the sample packets, thus, it 
is a sample method); see col. 1, lines 13-24, see col. 2, lines 67 to col. 3, lines 16). 

In view of this, having the system of Hegde'875 and then given the teaching of 
McKee'659, it would have been obvious to one having ordinary skill in the art at the time the 
invention was made to modify the system of Hegde'875, for the purpose of providing a 
network traffic data monitoring and collection method on sample packets, as taught by 
McKee'659, for the same purpose and motivation as described in claims 1 ,9,16 and 23. 

Regarding claims 4, 12, 19 and 26, the combined system of Hegde'875 and 
* McKee'659 discloses wherein forwarding the group of information to the destination as 
described in claims 1,9,16 and 23. 
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Hegde'875 further discloses identifying the destination (see FIG. 8, S44, an entry of a 
flow) using a forwarding table (see FIG. 2 and FIG. 5, Flow Table 70; see col. 2, lines 65 to 
col. 3, lines 9; see col. 9, lines 40-55; note that IP header is extracted and determined if the 
flow entry is in the flow table); 

if the destination is in the forwarding table (see FIG. 8, S46; the entries in the flow 
table is Yes), automatically forwarding the group of information to the destination (see FIG. 
8, S46; note that the packet is forwarded according to a flow in the flow table at wire speed; 
see col. 3, lines 6-7; col. 9, lines 50-55) and 

otherwise sending the group of information to one or more processing engines to 
determine routing to the destination (see FIG. 8, S56; Forwarded to CPU for processing; col. 
3, lines 2-6; note that when there is no entry of a flow in the flow table, the packet is 
forwarded to CPU to be processed. See FIG. 9, S88, S90, S94; the CPU determines and 
creates/updates the table with new forwarding information; see FIG. 9, S72, S94; see col. 3, 
lines 3-5,see col. 10, lines 36-44, see col. 11, lines 65 to col. 12, lii\es 5) and 

forwarding the group of information according to the determined routing (see FIG. 8, 
S46, S50; see col. 3, line 4-10, see col. 10, lines 24-32; note that once the flow is identified 
and the address is resolved, the IP packet is forwarded according to the created/updated 
designated flow). 

Regarding claim 5, Hegde'875 discloses wherein forwarding the group of 
information to the destination (see FIG. 8, S46; forwarding packet according to the flow 
table) is performed after processing the group of information (see FIG. 8, S40, S42 and S44; 
getting, checking and determining the IP packet for a flow; see col. 9, lines 44-49; note that 
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forwarding IP packet according to the designated step is executed after the step of processing 
IP packet for a flow information is performed) . 

6. Claim 6, 13 and 20 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Hegde'875 and McKee'659, as applied to claims 1,9 and 16 above, and further in view of Dietz 
(U.S. 6,651,099). 

Regarding claim 6, 13 and 20, Hegde'875 discloses determining if the group of 
information is part of one or more recorded traffic flows (see FIG. 8, S42, S44; see col. 2, 
lines 65 to col. 3, lines 9; see col 9, lines 40-55; note that IP header is extracted and 
determined if the traffic flow is in the flow table); 

creating a new entry in a table if the group of information is not part of the one or 
more recorded traffic flows (see FIG. 8, S56; Forwarded to CPU for processing; col. 3, lines 
2-6; note that when there is no entry of a flow in the flow table, the packet is forwarded to 
CPU to be processed. See FIG. 9, S88, S90, S94; the CPU updates the table with a new 
traffic flow; see FIG. 9, S72, S94; see col. 3, lines 3-5,see col. 10, lines 36-44, see col. 11, 
lines 65 to col. 12, lines 5); 

forwarding if the group of information is part of the one or more recorded traffic 
flows (see FIG. 8, S46, S50; see FIG. 12, SI 76; see col. 3, line 4-10, see col. 10, lines 24-32; 
note that once the flow is identified and the address is resolved, the IP packet is forwarded 
according to the created/updated designated flow). 

Neither Hegde , 875 nor McKee'659 explicitly disclose incrementing a field in an 
existing entry in the table; and time stamping the group of information. 
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However, the above-mentioned claimed limitations are taught by Dietz f 099. In 
particular, Dietz'099 teaches incrementing a field (see col. 24, lines 55-56, see col. 14, lines 
54-56; a packet count in the counters, and note that when counting, the data must be 
incremented) in an existing entry in the table (see FIG. 3, Flow entry database) if the group 
of information is part of the one or more recorded traffic flows (see FIG. 3, steps 316 and 
322; see col. 14, lines 3-35, 48-57; see col. 24, lines 50-59; note that when the packet is 
found to have a match flow-entry in the database 324, the calculator enters the measured 
statistical data in the flow-entry); and 

time stamping the group of information (see col. 20, line 40-65; note that the time 
stamps are generated, collected, and analyzed for each packet of the flow). 

In view of this, having the combined system of Hegde , 875 and McKee'659, then 
given the teaching of Dietz'099, it would have been obvious to one having ordinary skill in 
the art at the time the invention was made to modify the combined system of Hegde'875 and 
McKee'659, for the purpose of providing a mechanism of collecting traffic flows in the flow- 
entry database by utilizing counters, and time stamping the packet, as taught by Dietz'099, 
since Dietz'099 states the advantages/benefits at col. 4, lines 40 to col. 5, lines 10 that it 
would recognize and classify all flows that pass either direction of the network and tune the 
performance of the network. The motivation being that by collection the traffic flow 
information, it enhance the performance of the network since the resources are being 
monitored and occurrences of specific sequences of packets are being reported. 
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7. Claim 7,8,14,15,21, and 22 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Hegde'875, McKee'659 and Dietz'099, as applied to claim 6 above, and further in view of 
Takase (U.S. 5,822,535). 

Regarding claim 7, 14 and 21, the combined system of Hegde , 875, McKee'659 and 
Dietz'099 discloses the processing of the group of information for network traffic data 
collection as described above in claims 1 and 6. Hegde'875 further discloses a network traffic 
data collection application (see FIG. 2, Flow Table 70). Dietz'099 also discloses a network 
traffic data collection application (see FIG. 11, Lookup/update Engine LUE 1 107). 

Neither Hegde'875, McKee'659 nor Dietz'099 explicitly disclose creating a traffic 
information packet; and transmitting the traffic information packet. 

However, the above-mentioned claimed limitations are taught by Takase'535. In 
particular, Takase f 535 teaches creating a traffic information packet (see FIG. 17B, Response 
Packet; see col. 2, lines 55-61; see col. 20, lines 5-30; see FIG. 7, Steps S5-S7; note that upon 
receiving the call/request packet 401 from the management node 100, the managed node 301 
creates a response packet after collecting and accumulating according to the inquiry); and 

transmitting the traffic information packet to a network traffic data collection 
application (see FIG. 2, software application Management system 400 of the Management 
node 100; see FIG. 7, S8; the response packet is transmitted to the software application 
management system 400; see col 7, lines 50 to col. 9, lines 6). 

In view of this, having the combined system of Hegde'875, McKee'659 and 
Dietz'099, then given the teaching of Takase'535, it would have been obvious to one having 
ordinary skill in the art at the time the invention was made to modify the combined system of 
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Hegde'875, McKee'659 and Takase'535, for the purpose of providing a mechanism of 
transmitting a collected response packet to the collection management application system 
upon inquiry, as taught by Takase'535, since Takase'535 states the advantages/benefits at col. 
2, lines 45 to col. 3, lines 40 that it would reduce the amount of traffic flow in the network by 
preventing concentration of network load. The motivation being that by transmitting 
collected response packet only upon request to the management software application, it can 
reduce the network congestion since the collected packet is transmitted only upon request. 

Regarding claim 8, 15 and 22, Takase'535 discloses wherein the traffic information 
packet comprises a header (see FIG. 17B, Protocol Header 171) and one or more flow 
records (see FIG. 1 7B, Attribute Value); see col. 20, lines 5-42. 

In view of this, having the combined system of Hegde'875, McKee'659 and 
Dietz'099, then given the teaching of Takase'535, it would have been obvious to one having 
ordinary skill in the art at the time the invention was made to modify the combined system of 
Hegde'875, McKee'659 and Takase'535, for same purpose as described above in claims 7,14, 
and 21. 

8. Claims 23 and 27 rejected under 35 U.S.C. 103(a) as being unpatentable over Hegde'875 
and McKee'659, and further in view of Hebb (U.S. 6,463,067). 

Regarding claim 23, Hegde'875 discloses an apparatus (see FIG. 2, Multiprotocol 
Switch 40) for collecting network traffic data comprising: 

one or more route processors (see FIG. 2, CPU 80); 
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one or more switch fabrics (see FIG. 2, Switch Module 60) coupled to the one or 
more route processors (see FIG. 2, Switch module 60 is connected to CPU 80); 

one or more destination line cards (see FIG. 1 and 2, transmitting ports of the 
Input/output ports 50-1 . . . 50-N which interface with network nodes, also each port must be 
on the card) coupled to the one or more switch fabrics (see FIG. 2, Input/output ports 50 is 
connected to Switch Module 60; see col. 4, lines 34-53); 

a source line card (see FIG. 1 and 2, receiving ports of the Input/output ports 50- 
1 . . . 50-N which interface with network nodes, also each port must be on the card) coupled to 
the one or more switch fabrics (see FIG. 2, Input/output ports 50 is connected to Switch 
Module 60; see col. 4, lines 34-53), 

wherein the source line card receive a group of information (see FIG. 2, receiving 
ports of Input/output ports 50 receive IP packet; see col. 4, lines 34-53, see FIG. 7, S30 and 
S32; see col. 8, lines 250 to col. 9, lines 390); 

Determine whether to process the group of information for network traffic data 
collection (see FIG. 8, S42, S44; see col. 2, lines 65 to col. 3, lines 9; see col. 9, lines 40-55; 
note that IP header is extracted and determined if the flow (i.e. source and destination) is in 
the flow table for updating/creating the new forwarding information in the flow table 70 (also 
see FIG. 5)); 

process the group of information for network traffic data collection if the 
determination is to process the group of information (see FIG. 9, S72, S94; see col. 3, lines 3- 
5,see col. 10, lines 36-44, see col. 11, lines 65 to col. 12, lines 5; note that the new 
forwarding information is created in the flow table when the flow from extracted IP header is 
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not in the flow table; also see FIG. 10 for recording/collecting the entries in the flow table); 
and 

forward the group of information to the destination (see FIG. 8, S46, S50; see col. 3, 
line 4-10, see col. 10, lines 24-32; note that once the flow is identified and the address is 
resolved, the IP packet is forwarded to the destination); 

Hegde'875 does not explicitly disclose collection according to a sample algorithm. 

However, the above-mentioned claimed limitations are taught by McKee'659. In 
particular, McKee'659 teaches network traffic data collection according to a sample 
algorithm (see FIG. 6, a method/algorithm which collects network traffic data (i.e. a 
monitoring system which randomly collects the traffic data from the sample packets, thus, it 
is a sample method); see col. 1, lines 13-24, see col 2, lines 67 to col. 3, lines 16). 

In view of this, having the system of Hegde , 875 and then given the teaching of 
McKee'659, it would have been obvious to one having ordinary skill in the art at the time the 
invention was made to modify the system of Hegde'875, for the purpose of providing a 
network traffic data monitoring and collection method on sample packets, as taught by 
McKee'659, since McKee'659 states the advantages/benefits at col 3, lines 5-39 that it would 
facilitate the identification of significant data items relevant to management of a network. 
The motivation being that by monitoring and collection data, it can increase the network 
performance since the system is able to collect data regarding the network and path 
configuration, provisioning, routing, forwarding for future use, and to identify any potential 
problems in the network. 
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Neither Hegde'875 nor McKee , 659 explicitly discloses the source line card (see 
Hebb'067 FIG. 2, a line interface unit PHY I/O and Framing 20 unit) process the group of 
information (see Hebb'067 FIG. 2, Forwarding Engine 22 within interface card 20 processes 
the received packets by segmenting and forwarding them toward the switch fabric 16; see 
cHebb*067 col. 3, lines 55-60), and 

forward the group information to one or more destination line cards (see McKee'659 
FIG. 2, another PHY I/O and Framing 20 unit; note that a segmented packet is send from 
switch fabric 16 to outgoing line interface PHY I/O and Framing 20 unit, and then the 
received segments are reassembled into packets for outgoing transfers; see col. 3, lines 50- 
62). 

However, the above-mentioned claimed limitations are taught by Hebb'067. In view 
of this, having the combined system of Hegde'875 and McKee'659, then given the teaching 
of Hebb'067, it would have been obvious to one having ordinary skill in the art at the time the 
invention was made to modify the combined system of Hegde'875 and McKee'659, for the 
purpose of providing processing packets within input line interface unit and sending the 
processed data to outgoing line interface unit, as taught by Hebb'067, since Hebb'067 states 
the advantages/benefits at col. 2, lines 25-54 that it would enhance the efficiency and speed 
of the communication between the packet process and the forwarding engine, and allowing 
for high-speed packet forwarding and classification. The motivation being that by processing 
the packet at the incoming port and forwarding to the switch fabric and the outgoing port, it 
can increase the performance of the network and enhance the packet classification since the 
packet is proceed at incoming port before traversing the router. 
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Regarding claim 27, Hebb f 067 discloses wherein the one or more processing engines 
(see FIG. 2, Forwarding Engine 22) is located on the source line card (see Hebb'067 FIG. 2, a 
line interface unit PHY I/O and Framing 20 unit; note that Forwarding Engine 22 within 
interface card 20; col. 3, lines 55-60). 

In view of this, having the combined system of Hegde'875 and McKee'659, then 
given the teaching of Hebb'067, it would have been obvious to one having ordinary skill in 
the art at the time the invention was made to modify the combined system of Hegde'875 and 
McKee'659, for the same purpose as described above in claim 23. 

9. Claim 28 is rejected under 35 U.S.C. 103(a) as being unpatentable over Hegde'875, 
McKee'659 and Hebb'067, as applied to claim 23 above, and further in view of Dietz (U.S. 
6,651,099). 

Regarding claim 28, Hegde'875 discloses determining if the group of information is 
part of one or more recorded traffic flows (see FIG. 8, S42, S44; see col. 2, lines 65 to col. 3, 
lines 9; see col. 9, lines 40-55; note that IP header is extracted and determined if the traffic 
flow is in the flow table); 

creating a new entry in a table if the group of information is not part of the one or 
more recorded traffic flows (see FIG. 8, S56; Forwarded to CPU for processing; col. 3, lines 
2-6; note that when there is no entry of a flow in the flow table, the packet is forwarded to 
CPU to be processed. See FIG. 9, S88, S90, S94; the CPU updates the table with a new 
traffic flow; see FIG. 9, S72, S94; see col. 3, lines 3-5,see col. 10, lines 36-44, see col. 1 1, 
lines 65 to col. 12, lines 5); 
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forwarding if the group of information is part of the one or more recorded traffic 
flows (see FIG. 8, S46, S50; see FIG. 12, S176; see col. 3, line 4-10, see col. 10, lines 24-32; 
note that once the flow is identified and the address is resolved, the IP packet is forwarded 
according to the created/updated designated flow). 

Neither Hegde'875 nor McKee'659 explicitly disclose incrementing, a field in an 
existing entry in the table; and time stamping the group of information. 

However, the above-mentioned claimed limitations are taught by Dietz'099. In 
particular, Dietz'099 teaches incrementing a field (see col. 24, lines 55-56, see col. 14, lines 
54-56; a packet count in the counters, and note that when counting, the data must be 
incremented) in an existing entry in the table (see FIG. 3, Flow entry database) if the group 
of information is part of the one or more recorded traffic flows (see FIG. 3, steps 316 and 
322; see col. 14, lines 3-35, 48-57; see col. 24, lines 50-59; note that when the packet is 
found to have a match flow-entry in the database 324, the calculator enters the measured 
statistical data in the flow-entry); and 

time stamping the group of information (see col. 20, line 40-65; note that the time 
stamps are generated, collected, and analyzed for each packet of the flow). 

In view of this, having the combined system of Hegde'875 and McKee'659, then 
given the teaching of Dietz'099, it would have been obvious to one having ordinary skill in 
the art at the time the invention was made to modify the combined system of Hegde'875 and 
McKee'659, for the purpose of providing a mechanism of collecting traffic flows in the flow- 
entry database by utilizing counters, and time stamping the packet, as taught by Dietz'099, 
since Dietz'099 states the advantages/benefits at col. 4, lines 40 to col. 5, lines 10 that it 
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would recognize and classify all flows that pass either direction of the network and tune the 
performance of the network. The motivation being that by collection the traffic flow 
information, it enhance the performance of the network since the resources are being 
monitored and occurrences of specific sequences of packets are being reported. 

10. Claims 29 and 30 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Hegde'875, McKee'659, Hebb , 067 and Dietz'099, as applied to claim 28 above, and further in 
view of Takase (U.S. 5,822,535). 

Regarding claim 29, the combined system of Hegde'875, McKee'659, Hebb'067 and 
Dietz'099 discloses the processing of the group of information for network traffic data 
collection as described above in claims 1 and 6. Hegde'875 further discloses a network traffic 
data collection application (see FIG. 2, Flow Table 70). Dietz'099 also discloses a network 
traffic data collection application (see FIG. 11, Lookup/update Engine LUE 1 107). 

Neither Hegde'875, McKee'659, Hebb'067, nor Dietz'099 explicitly disclose creating 
a traffic information packet; and transmitting the traffic information packet. 

However, the above-mentioned claimed limitations are taught by Takase'535. In 
particular, Takase'535 teaches creating a traffic information packet (see FIG. 17B, Response 
Packet; see col. 2, lines 55-61; see col. 20, lines 5-30; see FIG. 7, Steps S5-S7; note that upon 
receiving the call/request packet 401 from the management node 100, the managed node 301 
creates a response packet after collecting and accumulating according to the inquiry); and 

transmitting the traffic information packet to a network traffic data collection 
application (see FIG. 2, software application Management system 400 of the Management 
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node 100; see FIG. 7, S8; the response packet is transmitted to the software application 
management system 400; see col. 7, lines 50 to col. 9, lines 6). 

In view of this, having the combined system of Hegde'875, McKee'659, Hebb'067 
and Dietz'099, then given the teaching of Takase'535, it would have been obvious to one 
having ordinary skill in the art at the time the invention was made to modify the combined 
system of Hegde'875, McKee'659, Hebb'067 and Dietz'099, for the purpose of providing a 
mechanism of transmitting a collected response packet to the collection management 
application system upon inquiry, as taught by Takase'535, since Takase'535 states the 
. advantages/benefits at col. 2, lines 45 to col. 3, lines 40 that it would reduce the amount of 
traffic flow in the network by preventing concentration of network load. The motivation 
being that by transmitting collected response packet only upon request to the management 
software application, it can reduce the network congestion since the collected packet is 
transmitted only upon request. 

Regarding claim 30, Takase'535 discloses wherein the traffic information packet 
comprises a header (see FIG. 17B, Protocol Header 171) and one or more flow records (see 
FIG. 17B, Attribute Value); see col. 20, lines 5-42. 

In view of this, having the combined system of Hegde'875, McKee'659, Hebb'067 
and Dietz'099, then given the teaching of Takase'535, it would have been obvious to one 
having ordinary skill in the art at the time the invention was made to modify the combined 
system of Hegde'875, McKee'659, Hebb'067 and Dietz'099, for same purpose as described 
above in claims 7,14, and 21. 
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Response to Arguments 

11. Applicant's arguments filed 9-3-2004, regarding amended claims 1-30 have been fully 
considered but they are not persuasive. 

Regarding claims 1,9,16 and 23, the applicant argued that, ". . .neither the cited 
sections of Hegde nor the cited of the additional references discloses. . .processing the group 
of information for network traffic data collection if the determination is to process the group 
of information. . . " in page 11,3 paragraph, and "... applicant found disclosure within Hegde 
of the network traffic data collection as claimed.." in page 12, 2 nd paragraph. 

In response to applicant's argument, the examiner respectfully disagrees that 
neither the cited sections of Hegde nor the cited of the additional references 
discloses. . . processing the group of information for network traffic data collection if the 
determination is to process the group of information, or network traffic data collection. 

Hegde discloses process the group of information for network traffic data collection if 
the determination is to process the group of information (see FIG. 9, S72, S94; see col. 3, 
lines 3-5, see col. 10, lines 36-44, see col. 11, lines 65 to col. 12, lines 5; note that the new 
forwarding information is created in the flow table when the flow from extracted IP 
header is not in the flow table; also see FIG. 10 for recording/collecting the entries in 
the flow table). 

Note that Examiner asserts "the network traffic data" or "network traffic data" as 
Hegde's flow data stores/updates in the Hegde's flow table (see FIG. 2, flow table 70). Flow 
data or network traffic data is in a received IP/IPX header, and the flow is identified by the 
IP/IPX addresses of the hosts (i.e. path/route between source and the destination), IP/IPX 
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socks, and/or protocol by which the hosts are communicating. Per FIG. 9, step 72, the 
received packet is processed by extracting the flow information if it the flow is unresolved, 
and collects/stores the new flow in the flow table, thereby, updating the flow table. Thus, 
collection of flow data is performed when the new/updated flow data is stored in the flow 
table. Hegde clearly discloses above argued limitations. 

The applicant argued that, ". . .McKee do not discloses a sample algorithm. . in 
page 13, 2 nd paragraph. 

In response to applicant's argument, the examiner respectfully disagrees that 
McKee do not discloses a sample algorithm. 

McKee discloses a sample algorithm (see FIG. 6, a method/algorithm which 
collects network traffic data (i.e. a monitoring system which randomly collects the 
traffic data from the sample packets, thus, it is a sample method); see col. 1, lines 13-24, 
see col. 2, lines 67 to col. 3, lines 16). 

Examiner asserts "an algorithm" is "a method". Hegde discloses the method, see 
Hegde FIG. 6-14. McKee discloses the sample algorithm/method by utilizing randomize the 
burst and traffic attributes, see McKee FIG. 6. Note that according to the claim, "a sample 
algorithm" can be any algorithm/method that performs sampling. It is also noted that the 
applicant is arguing the McKee does not discloses a sample algorithm, however, at the same 
time, applicant is admitting that McKee discloses "random sampling" (see argument page 14, 
1 st paragraph). 

The applicant argued that, "...there is no teaching, suggestion, or motivation to 
combine the reference either in Hegde or McKee or in the knowledge of the art. . .Hegde 
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discloses a router. . . every packet. . . continually monitoring of incoming packets. . . switch 
engine. . ." in page 13, 2 nd paragraph; page 14, 2 nd paragraph; and page 12, 3 rd paragraph. 

In response to applicant's argument that the references fail to show certain features 
of applicant's invention, it is noted that the features upon which applicant relies (i.e., a 
router.* .every packet. ..continually monitoring of incoming packets... switch engine) are 
not recited in the rejected claim(s). Although the claims are interpreted in light of the 
specification, limitations from the specification are not read into the claims. See In re Van 
Geuns, 988 F.2d 1 181, 26 USPQ2d 1057 (Fed. Cir. 1993). 

In response to applicant's argument that there is no suggestion to combine the 
references, the examiner recognizes that obviousness can only be established by combining 
or modifying the teachings of the prior art to produce the claimed invention where there is 
some teaching, suggestion, or motivation to do so found either in the references themselves 
or in the knowledge generally available to one of ordinary skill in the art. See In re Fine, 837 
F.2d 1071, 5 USPQ2d 1596 (Fed. Cir. 1988)and/« re Jones, 958 F.2d 347, 21 USPQ2d 1941 
(Fed. Cir. 1992). In this case, as previously identified in the first office action, for the 
purpose of providing a network traffic data monitoring and collection method on sample 
packets, as taught by McKee'659, since McKee'659 states the advantages/benefits at col. 3, 
lines 5-39 that it would facilitate the identification of significant data items relevant to 
management of a network. The motivation being that by monitoring and collection data, it 
can increase the network performance since the system is able to collect data regarding the 
network and path configuration, provisioning, routing, forwarding for future use, and to 
identify any potential problems in the network. 



Application/Control Number: 09/779,248 Page 20 

Art Unit: 2661 

In response to applicant's argument that a person of ordinarily skill in the art would 
not expect success to be achieve by coming Hegde with McKee random sampling, the test for 
obviousness is not whether the features of a secondary reference may be bodily incorporated 
into the structure of the primary reference; nor is it that the claimed invention must be 
expressly suggested in any one or all of the references. Rather, the test is what the combined 
teachings of the references would have suggested to those of ordinary skill in the art. See In 
re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981). Note that Hegde discloses the flow 
collection method/algorithm, and McKee also discloses a network traffic data collecting by 
sampling method/algorithm. Thus, Hegde system is being modified with the teaching of 
McKee, not replacing or "bodily incorporating". 

Regarding claims 3,11,18 and 25, the applicant argued that ". . McKee discloses 
wherein the sample algorithm is selected from one of liner, exponential, natural log, burst 
and traffic attribute Applicant respectfully submit that McKee contains no disclosure of the 
listed sample algorithms. . ." in page 14, 4 th paragraph. 

In response to applicant's argument, the examiner respectfully disagrees that 
McKee contains no disclosure of the listed sample algorithms. 

McKee'659 discloses wherein the sample algorithm is selected from one of linear, 
exponential, natural log, burst, and traffic attribute (see FIG. 6, a method/algorithm which 
collects network traffic attributes/data (i.e. a monitoring system which randomly 
collects the traffic data from the sample packets, thus, it is a sample method); see col. 1, 
lines 13-24, see col. 2, lines 67 to col. 3, lines 16). 
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Note that the claim limitation recites "... selected from one of. . ." Thus, only one 
limitation is required to meet, which is clearly disclosed by McKee. Examiner asserts "an 
algorithm" is "a method". Hegde discloses the method for network traffic data collection 
based on burst and traffic attributes (see FIG. 8-9, network attribute such as a flow or routing 
information). McKee also discloses the sample algorithm/method, for network traffic data 
collecting, is selected from traffic attributes (see McKee FIG. 6. steps 60-64; see col. 1, lines 
13-24, 35-37, see col. 2, lines 67 to col. 3, lines 16). Examiner asserts that McKee traffic 
attributes/data comprises headers, node IDs, information and etc. Thus, it is clear that McKee 
discloses the argued limitations. 

In view of the above, the examiner respectfully disagrees with applicant's argument 
and believes that the combination of references as set forth in the 103 rejections is proper, 
thus, Claims 1-30 are obvious over Hegde in view of McKee for at least the reasons 
discussed above. 

Conclusion 

12. Applicants amendment necessitated the new ground(s) of rejection presented in this 
Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37 CFR 1 .136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
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will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1 .136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the date of this 
final action. 



13. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Ian N Moore whose telephone number is 571-272-3085. The 
examiner can normally be reached on M-F: 8:30 AM - 5:00 PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ken Vanderpuye can be reached on 571-272-3078. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 
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